Posted
by
samzenpus
on Thursday December 03, 2009 @12:18AM
from the none-more-infected dept.

garg0yle writes "According to McAfee, more than a third of Cameroon domains (TLD of .cm) are infested with viruses or other not-so-fun party treats. Given that it's very easy to mis-type .com as .cm, this puts the computers of a lot of fat-fingered typists in peril. Second place on the most-infested domains list goes to China (.cn), while Hong Kong (last year's 'winner') is now comfortably middle-of-the-pack."

While I can believe that.cm is a mistype for.com, what about.co,.con,.om? They don't seem to be high risk websites. I also bet that.con is a more common mistype than.cm
I also wonder whether slashdot.og is infested with viruses.

I wasn't aware that.con wasn't a valid TLD (It should be valid for the scammers).

Really? We should dedicate a whole TLD just for scammers? Was that supposed to be a joke?

And.og was meant to be a joke.

Ok, I guess you did mean it as a joke if you thought that one would fly too. It went over like a lead balloon, though.

Here's a tip from an internet professional: Do research before you make posts on a site that you can't delete or edit your comments on. If you make a mistake, reply to yourself and correct it. Otherwise people who have karma to burn will correct you, much like myself.

That different nations treat their TLDs differently. Some sell them to anyone who wants one. You can register them as long as you are willing to pay whatever fee it is they ask. The.tv domain is one such domain. Others make the domains available, but only to people or organizations that meet certain requirements like citizenship. Canada (.ca) would be one like that. Any Canadian can have a.ca domain if they are willing to pay for it, but non-Canadians can't buy one. Still others only use their domain for government or internal functions. The.us domain was like that at one time. You could get it only as an entity like a county government or a high school or something (it is now open for registration). Finally some countries simply don't do anything with their TLD, it just isn't used at all and there's no way to get it.

So just because a TLD exists, doesn't mean it can be used for any given purposes.

'But wheah's the necessity? It seems an uncommonly woundabout and hopelessly wigmawolish method of getting anywheahs. Look heah now, I've got the wuhks of the mastahs -- the gweat ahchaeologists of the past. I wigh them against each othah -- balance of the disagweements -- analyze the conflicting statements -- decide which is pwobably cowwect- and come to a conclusion. That is the scientific method. At least' -- patronizingly -- 'as I see it. How insuffewably cwude it would be to go to Ahctuwus, oah to Sol, foah instance, and blundah about, when the old mastahs have covahed the gwound so much moah effectually than we could possibly hope to.'

It depends on the policies of the registrar for those top level domains. Some countries allow free for all registration of domain names, others restrict registration to local companies and citizens only. Also many country tlds require specific sub-domains such as.com.co, which reduce the usefulness of those domains for typo-squatters.

In any case, if (as the article claims) one third of Cameroon domains host malware, the implication is that two thirds don't. I would be very curious to know what percentage of US domains host malware.

Regardless of the answer, the appropriate response is to use a robust browser and block individual sites, not block out whole nations. Otherwise one might just as well move to China.

Blocking.cm can be a helpful step, because it blocks a portion of the hostnames that (A) if you visit has a very high probability of infecting you, and (B) that an intentional visit to is unlikely.

So you can block.cm with a notable increase in safety, with a minimal decrease in usefulnes of your internet access.

The same could not be said of blocking the whole net. Blocking the whole net reduces the utility of your network connection, since it means you can no longer navigate to the sites that you do want to, with high probability.

I can safely say I've never done this. I've made other errors - such as ending up in Estonia's (.ee) web space on occasion, since I work in an electrical engineering department. But I can't believe leaving out the "o" from ".com" is particularly easy or at all common.

Now if you wanted to talk about Colombia (.co) being a frequent typo for.com domains, then I might find it more believable. I have done that on rare occasions.

I can safely say I've never done this. I've made other errors - such as ending up in Estonia's (.ee) web space on occasion, since I work in an electrical engineering department. But I can't believe leaving out the "o" from ".com" is particularly easy or at all common.

I can't figure out how you think ending up at a domain ending in.ee because you're an electrical engineer is less weird than mistyping.com

It's water under the bridge, but in hindsight, it would have been better to not create the alternate TLDs.cm,.co. While I'm at it, tell me there's a good reason we have augmented reality iPhones and 60 MPG cars but not web browsers that autocorrect non-existent TLDs.

typing *.cm instead of.com is as simple as having an o key that gets stuck occasionally and not noticing the typo. All it takes is a keyboard that needs a good cleaning and a user that isn't paying enough attention.

typing *.cm instead of.cm is as simple as having an key that gets stuck ccasinally and nt nticing the typ. All it takes is a keybard that needs a good cleaning and a user that isn't paying enough attentin.

Opendns has an option to automatically 'correct'.cm requests to.com, which I always turn on. If Cameroon does not want people doing this, then it would have to police it's domain closely, instead of using it as a cash cow.

On top of it there's nothing open about them. No source, no open development, community, etc. Its just a company that tracks people and breaks NXDOMAIN. Man, is running bind on something so hard? There's even a pretty nice dumbed down GUI windows port called Treewalk.

OpenDNS breaks the DNS standard, as it returns a search page for non-existent domains, there was actually a/. article about sites doing this not too long ago. Lastly, not to mention, you're letting a 3rd party track almost 100% of your net activity.

I see the real threat in letters getting mixed up (which probably does not matter so much in 3 letter TLDs, since I don't know of a cmo or ogr TLD) or a typo (.con,.prg), which also usually don't really result in anything damaging..cm being mistyped as.cn might be a problem, though. But then again, it's like missing the flood to reach the drought, so...

Let's get real and understand that the real purpose of providing this "information" is marketing. It is there to reinforce the message that the world is hopelessly infected with computer viruses and you absolutely MUST have the offerings of McAffee and other anti-virus software vendors. I'm not even sure why anyone would believe it is true.

There will always be a worst and best in this category, as in anything you do in life. The problem is when it is deliberately set to that which happens to be.cm (which could be a mistype for many people)...if you think of whether this was intentional on the hackers part, you better believe it.

It could be any of the countries that have domains, and have no real talent for programming websites, but in the end,you have to wonder, most are hosted on regular ISPs that offer the.cm extension, so should they not

You can run bind and play with the configuration or you can set your firewall to not let you make connections to cameroon's netblocks. That's assuming the cm stuff is actually hosted there. If not then you need to block via DNS.